Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 170 replies
  • Subscribers 33 subscribers
  • Views 34187 views
  • Users 0 members are here
Options
Suggested

Restricted Advance Shell - examples of challenges

PMParth

Hi Community contributors,

Starting Sophos Firewall v19, with the addition of many comprehensive logging enhancements in the GUI, and in-line with industry best-practices, access to the Advance Shell is restricted to licensed commercial versions of the product.

Partners and certified architect engineers have an option with Not-for-Resale license to set up labs or customer PoC with unrestricted advanced shell. Also, Sophos Support is able access the Advanced Shell via support access channel. Hence, in case of critical issues, support can still can access it.

Sophos Firewall has been incrementally improved since v18 with comprehensive logging enhancements in the GUI (Better search, filtering, configurations, SD-WAN logs, VPN logs, gateway logs etc). However, we acknowledge that Advance Shell restriction might have created challenges in certain database related configurations, especially for home users.

Please help us understand the specific examples of challenges you face due to this restriction - configurations where GUI and console tools are reaching the limits. We will suggest the possible workaround for the specific scenario. We will also plan and gradually improve the product for those scenario.

Sincerely,

Sophos Firewall Product Team

  • 0 in reply to LuCar Toni

    I am a partner. Since UTM the Home version was a good reason for many to check out Sophos firewall products in detail and I'm sure Sophos won many customers and partners just because of this version no one else offers. Sure, as a partner we get NFR licenses for our own firewall, but do I want to tinker arround with our production network? No.  wrote that the support could still access the shell, but how should I interpret this? That the support is starting to actively support home users? Really?!

    I don't see the point in all of this, except you'd tell me right now that Sophos has some clear evidence that the Home version is used commercially in a bigger scale, which I can't imagine is the case, but who knows?

    If you would supply your partners and customers with an easy way to get NFRs for virtual devices, I'd probably be happy and leave you alone with this, though I still don't get the point.

  • 0 in reply to LuCar Toni

    There is nothing in GUI log about SSL VPN. Only the creation of cert file at time of export from user portal. I can see correct port in/out in pcap. Looks something like what is running on the v18.

  • 0 in reply to Dreamcatcher

    Essentially Sophos as a company can still access the appliance in case of bug tracking or something. For example, a Home user discovers a bug in V19.0 and wants to report it. DEV can access the appliance and investigate this issue via SupportAccess. 

    From my point of view as the most activate person in the community by far (see leader board), the advanced shell is not needed in the majority of "threads". Simply because the product is in a state of having a simple UI to get the most common issues configured or debugged via GUI. And i am talking about a new installation / configuration of a home appliance. Most home users have a average use case of simple setups. And most likely, if you look at the threads by home users, there are certain configuration issues, which do not need any interaction with the CLI. Most likely if i point to "do a packet capture" they are most comfortable with the packet capture in the GUI. 

    Sophos Product management wants to gather open spots of still use cases, which the product does not cover (today). 

    There are valuable contributions to this thread already. 

    There are currently two different programs for Partners. The partner as a organisation can get NFR licenses for its own organisation. For example for the Firewall of the partner. Then there is a program for the education. If you are a Sophos Architect (you did the training and certification) you can get all Sophos products (and a 3 year Sophos Firewall subscription) for your own environment. 

    __________________________________________________________________________________________________________________

  • 0 in reply to Dreamcatcher

    Dropped by policy basically means the spam engine did drop it. You can reference to this on the CLI, if you like. But we will pick this up, why the dropping does not contain the SMTP context. 

    __________________________________________________________________________________________________________________

  • 0 in reply to cougarman

    Please create a own thread in the Community to get this investigate further. 

    __________________________________________________________________________________________________________________

  • 0 in reply to Godzilla#1

    Currently there is no workaround of "downloading" the wireshark dump. You can still do a packet capture on CLI (console) and on GUI. 

    But apparently there is no download of this dump. 

    Just out of curiosity: If you look at the packet capture of the Webadmin: What use cases do you miss there to resolve your issues beside a download capability for Wireshark? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    You cannot compare at all the WebUI packet capture viewer compared to opening the pcap with wireshark.

    You're a Sophos Employee, you should already know the limits and challenges of using the Firewall WebUI by now.

    If a post solves your question use the 'Verify Answer' button.

    Ryzen 5600U + I226-V (KVM) v20 GA @ Home

    XG 115w Rev.3 8GB RAM v19.5 MR3 @ Travel Firewall

  • 0 in reply to Prism

    I know what i can do in the webadmin and most likely it should be sufficient for XX % of the home users. I mean, i am interacting with Sophos Customers the entire day. And most of them use the webadmin packet capture. Simply because they do not use the CLI in the first place. They simply want to know the following:

    Is there a packet?
    Which interface is used?
    Which Firewall rule is used?
    Is NAT being used? 

    The more advanced troubleshooting like looking into Header, checking TLS handshakes is not being done by the average user. And i am assuming the same are doing home users. 

    BTW: You can do the same just not "graphical". You see the HEX dump of a packet. Means you could translate this into a dump, if you really want. 

    __________________________________________________________________________________________________________________

  • 0

    Downloading Logfiles (as described in https://support.sophos.com/support/s/article/KB-000035842) should still be possible.
    When you need to have a deeper look into (older) logfiles for analysis.

    What about integrating full logfile-download and archive in GUI? As avaliable in UTM/SG?

Unfiltered HTML